A founder wants a five-person team to use a lead-assignment app. She has a GitHub repository but also wants to invite an external collaborator without granting access to all of Cursor. Should she build with Cursor Build Live Apps or Replit Agent? Both can turn a description into a published app. The choice depends on who signs in, where data lives, and who controls each release. This comparison uses official product documentation; it is not a SoyJB speed or output-quality benchmark.

One task with the same acceptance test

Build a fictional lead table with an owner, status, and next action. An admin may reassign leads, a seller may edit only their own rows, and a reader may see a dashboard without editing. Use two test accounts and a private release for five people. In either product, test a copied URL to someone else's record, an unauthorized update, and a reload that preserves allowed data. “It has login” is not evidence of per-user isolation until those checks pass.

What Cursor documents

Cursor announced Build Live Apps on November 5. From a Cloud Agent, you can request an app; Cursor can provision Postgres, Cursor SSO authentication, and hosting, starting from a new or existing GitHub or Cursor Origin repository. Its Apps documentation explains that private and team apps use Cursor sign-in and can be shared with specific people or groups. Individual plans can publish publicly, while public sharing on Teams and Enterprise is off by default unless an admin enables it.

That is attractive for an internal prototype when the team already works in Cursor and keeps its code in a shared repository. It also raises a practical question: will an outside collaborator have the identity and permission they need? Check the intended audience in Apps settings before building. Cursor runs pre-publish checks and requires an explicit publish action, separating development from deployment. Those checks do not by themselves prove that seller A cannot read seller B's leads.

What Replit documents

Replit Agent builds apps with built-in database and authentication. Replit Auth supports social or email sign-in and stores user information in the app database. For a portal used by people outside the builder's own team, that end-user identity model may be more natural than requiring sign-in to a development platform. Replit also documents Private Publishing to limit who can reach a published app. Its May 2026 announcement says private publishing extends to Starter and Core as well as Pro and Enterprise.

Replit describes separate development and production databases for new apps in its database announcement. That does not remove the need to inspect migrations and authorization. If you connect real data or a CRM, review the agent's access and the credentials it stores. A private deployment does not prove the app's own code enforces row-level permissions.

A decision test with the same brief

Give both products the same brief and record three results. First, access: can the five intended users sign in while a sixth, uninvited person stays out? Second, data: does seller A receive a denial when querying seller B's lead through a URL or API, and do allowed edits persist? Third, release: who approves publishing, where are the logs, and how can you roll back a version? Use fictional data and test accounts in both environments. Do not grant production credentials just to make the evaluation feel faster.

Build a private lead app for five people using fictional records.
Roles: admin, seller, reader.
Sellers may read and edit only assigned leads, enforced on the server.
Show the schema and authorization rules before publishing.
Create two test users with different leads and a denied-access test.
Use no real CRM or secrets. Do not publish without my review.
At the end, show how to invite users, view logs, and revert a release.

Choose Cursor when your team already shares its repository and Cursor identity, and its team controls fit the audience. Choose Replit when you need to test an end-user sign-in flow with Replit Auth or want a single integrated build-and-publish space. If neither passes the authorization and rollback test, choose an architecture you can control more closely. Do not ship merely because an agent produced a link. We do not compare live prices, limits, or execution outcomes here because they depend on plans and we have not run this experiment on both platforms.